Skip to content

sealr 0.1.0-alpha.4: measured semantic contract preview

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Aug 01:12
Immutable release. Only release title and notes can be modified.
v0.1.0-alpha.4
3c43818
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

sealr 0.1.0-alpha.4

This fourth development preview closes the measured semantic contract planned for Alpha.4. It adds a reusable verified-archive capability, bounded one-pass semantic-member retention, a closed strict ASCII ZIP profile, independently checked identity vectors, finite-domain property gates, and a reproducible wheel compatibility pilot.

It remains a preview. Sealr does not yet use a private file-backed snapshot or reduced-authority worker, recognize Python wheels as a consumer type, validate wheel metadata or RECORD, provide stable signed locks, or claim production qualification against arbitrary hostile archives.

Highlights

  • VerifiedArchive is an opaque capability available only after complete verification and admission. It supports caller-bounded exact-member reads without reopening or reparsing the source.
  • RetentionPlan selects at most 64 exact canonical paths under independent path, per-member, and aggregate limits. Selected bytes are retained during the original verification stream and can be borrowed without another parse, inflation, allocation, or hash.
  • sealr.profile.zip.strict-ascii.v2 is explicitly selectable through ApplyOptions. It preserves Store and Deflate, treats data-descriptor bit 3 as semantic, denies every other general-purpose flag bit, denies every extra-field ID, and accepts ASCII member names only. Finite tests cover all 65,536 flag words and all 65,536 extra-field identifiers.
  • sealr.profile.zip.strict-ascii.v1 remains byte-for-byte immutable and is still selected by the compatibility apply() facade.
  • The identity-conformance bundle contains exact canonical bytes for both profiles. A standalone workspace verifier with no Sealr dependency checks their digests and independently reproduces the committed ZIP32 covering plus layout and content roots.
  • Six named finite-domain property families cover compression ratios, verified-member limits, checked intervals, exact partitions, atomic quota transitions, and deterministic retention selection.
  • The packaged-crate gate runs an isolated exact-version consumer against Cargo's extracted package and exercises strict-v2 selection, retained reads, fallback reads, error categories, and capability ownership.
  • A reproducible 20-wheel pilot binds 90,417,280 exact source bytes, analyzer revision, strict-v2 profile digest, and default-policy digest. It admits 19 wheels and denies SciPy for three exact quota.ratio findings. Required CI verifies the committed report offline.

Security and correctness fixes

  • Matching strong-encryption and masked-header flags can no longer bypass the encryption policy.
  • ZIP64 count sentinels, understated central-header counts, and local-header offset overflow are classified without truncation or unchecked arithmetic.
  • ZIP discovery and the codec-free covering audit share one checked interval and exact-partition kernel.
  • Declared totals, actual totals, remaining capacity, and member byte counts share one atomic quota transition. Failed updates leave state unchanged.
  • Path and byte inputs retain honest source-digest and snapshot-kind evidence across cap and I/O failures.
  • A selected v2 interpretation identity is preserved on policy, source, format, and structure failures rather than falling back to v1 evidence.
  • Wheel acquisition and cached-file verification use bounded fixed-buffer reads, exact sizes, SHA-256 pins, redirect refusal, and safe partial-file promotion.

Compatibility evidence

The strict-v2 pilot observed 4,504 interpreted members, all using Store or Deflate with flags 0x0000 and no extra fields. The initial sample therefore supports the closed ASCII contract but does not estimate PyPI-wide compatibility or justify a wheel-oriented UTF-8 profile.

Setuptools contained twelve nested vendored .dist-info trees in addition to its own top-level directory. Future wheel evaluation must bind the normalized outer filename to exactly one matching top-level .dist-info directory instead of treating every suffix match as artifact metadata.

Verification

The required CI workflow runs format and workflow validation, Clippy with warnings denied, debug and release tests, optimized builds, rustdoc, documentation contracts, identity conformance, the wheel-report verifier, the extracted-package consumer, native macOS and Windows tests, the i686 Windows ABI check, 5,927 ZipDiff constructions, cargo-deny policy, and deterministic third-party license verification.

Release archives contain the native CLI, README, changelog, Apache-2.0 license, and target-specific third-party notices. SHA256SUMS and GitHub build provenance are published with the three native archives.

Next

Alpha.5 replaces whole-archive in-memory ownership for path inputs with a private file-backed snapshot. Copy, hash, retain, checked random access, mutation resistance, and bounded-memory evidence precede the supervised Linux worker planned for Alpha.6.

Assets 7
Loading